All MIBs › CISCO-IPSEC-POLICY-MAP-MIB › ipSecPolMapAclString
ipSecPolMapAclString
Module: CISCO-IPSEC-POLICY-MAP-MIB
OID (symbolic): CISCO-IPSEC-POLICY-MAP-MIB::ipSecPolMapAclString
OID (numeric): 1.3.6.1.4.1.9.9.172.1.2.1.1.4
Node type: OBJECT-TYPE
Type: DisplayString
Access: read-only
Description: The value of this object is the number or the name of the access control string (ACL) that caused this IPSec tunnel to be established. The ACL that causes an IPSec tunnel to be established is referenced by the cryptomap of the tunnel.
The ACL identifies the traffic that requires protection as defined by the policy.
For instance, the ACL that requires FTP traffic between local subnet 172.16.14.0 and a remote subnet 172.16.16.0 to be protected is defined as
==>access-list 101 permit tcp 172.16.14.0 0.0.0.255 172.16.16.0 0.0.0.255 eq ftp
When this command causes an IPSec tunnel to be established, the object 'ipSecPolMapAclString' assumes the string value '101'.
If the ACL is a named list such as ==> ip access-list standard myAcl permit 172.16.16.8 0.0.0.0
then the value of this MIB element corresponding to IPSec tunnel that was created by this ACL would be 'myAcl'.
What is ipSecPolMapAclString?
This reports the number or name of the access control list (ACL) that caused this IPSec tunnel to be established, per its description, since the ACL referenced by a cryptomap defines exactly which traffic requires protection under that policy. It's the direct link between a live tunnel and the traffic-matching rule that triggered it, which matters when diagnosing why a tunnel came up for one type of traffic but not another. The description's own example - an ACL requiring FTP traffic between subnet 172.16.14.0 and 172.16.16.0 to be protected - shows how this value points straight to the rule that decided this specific tunnel needed to exist.
Examples
Walk all instances (SNMPv2c):
snmpwalk -v2c -c public <target> 1.3.6.1.4.1.9.9.172.1.2.1.1.4 snmpwalk -v2c -c public <target> CISCO-IPSEC-POLICY-MAP-MIB::ipSecPolMapAclString
Get a specific instance (index 1):
snmpget -v2c -c public <target> 1.3.6.1.4.1.9.9.172.1.2.1.1.4.1 snmpget -v2c -c public <target> CISCO-IPSEC-POLICY-MAP-MIB::ipSecPolMapAclString.1
Start monitoring Cisco IPsec VPN router/firewall (ASA, ISR) with a free 30-day trial of IPNetwork Monitor. Create custom SNMP monitor using the CISCO-IPSEC-POLICY-MAP-MIB::ipSecPolMapAclString OID value, configure state conditions and alerts, and monitor any Cisco IPsec VPN router/firewall (ASA, ISR) from a single console.
OID Breakdown
Upper-level ancestors (8 from the standard OID tree / other modules)
| Numeric OID | Name | Module |
|---|---|---|
| 1 | iso | LANART-AGENT |
| 1.3 | org | AirPair-MIB |
| 1.3.6 | dod | AirPair-MIB |
| 1.3.6.1 | internet | AirPair-MIB |
| 1.3.6.1.4 | private | AirPair-MIB |
| 1.3.6.1.4.1 | enterprises | AirPair-MIB |
| 1.3.6.1.4.1.9 | cisco | CAT2600-MIB |
| 1.3.6.1.4.1.9.9 | ciscoMgmt | CISCO-SMI |
| Numeric OID | Name | Module |
|---|---|---|
| 1.3.6.1.4.1.9.9.172 | ciscoIpSecPolMapMIB | CISCO-IPSEC-POLICY-MAP-MIB |
| 1.3.6.1.4.1.9.9.172.1 | ciscoIpSecPolMapMIBObjects | CISCO-IPSEC-POLICY-MAP-MIB |
| 1.3.6.1.4.1.9.9.172.1.2 | ipSecPhaseTwoPolMap | CISCO-IPSEC-POLICY-MAP-MIB |
| 1.3.6.1.4.1.9.9.172.1.2.1 | ipSecPolMapTable | CISCO-IPSEC-POLICY-MAP-MIB |
| 1.3.6.1.4.1.9.9.172.1.2.1.1 | ipSecPolMapEntry | CISCO-IPSEC-POLICY-MAP-MIB |
| 1.3.6.1.4.1.9.9.172.1.2.1.1.4 | ipSecPolMapAclString | CISCO-IPSEC-POLICY-MAP-MIB |